Privacy
Privacy policy
ServerDiff works without accounts, tracking cookies or analytics. This page lists everything the site does store, and why.
Last updated
Highlighted parts are placeholders: the operator’s legal identity, the hosting provider and its location, other service providers, and retention periods. Replace them once the deployment is decided, and have this policy reviewed before the site goes live.
On this page12
In short
- No tracking cookies, analytics, advertising or third-party scripts, fonts or embeds. Your browser only loads files from serverdiff.com.
- Preferences you set, such as the theme, table columns, your shortlist and your currency, stay in your browser.
- Clicks on links to providers, comparisons opened and server lists viewed are counted as daily totals with no personal data.
- If you report a correction, we store your message and, only if you give it, your e-mail address.
Who is responsible
The controller for the personal data described here is [operator’s legal name and postal address]. You can reach us at [email protected].
Server logs and abuse limits
The ServerDiff application does not write access logs. The hosting provider and the web server in front of the application may record standard request data, namely IP address, time, requested address, browser user agent and referring page, for security and troubleshooting. These logs are kept for [log retention, for example 14 days].
To limit abuse, the server keeps the IP address of anyone who sends a correction report or tries to sign in to the administration area in its working memory: correction reports are limited to five per hour from one address, and sign-in attempts to eight per 15 minutes. These addresses are never written to the database and are discarded when the server restarts. The basis is our legitimate interest in keeping the service secure and available (Art. 6(1)(f) GDPR).
Cookies
We set no tracking, analytics, advertising or consent cookies. The only cookie a visitor can
receive is a functional one: when you choose a currency in the currency menu, we remember it for
one year in the cookie sd_cur. It holds only the currency code, such as EUR, and your
browser sends it to us with each request so that prices appear in that currency. Administrators
who sign in to the private administration area get a second cookie, sd_admin, which
keeps them signed in. It holds a random session token that we store only as a one-way hash, is
sent only to the administration area, and expires at the latest seven days after signing in or
when the administrator signs out.
Provider websites you open through our links set their own cookies under their own policies, including affiliate cookies where a link may earn us a commission.
Preferences in your browser
A few settings are kept in your browser’s local storage, so they survive a reload:
| Key | What it stores | Written |
|---|---|---|
sd-theme | Your colour theme, light or dark. Removed when you switch back to the system setting. | When you use the theme button |
sd.cols.v3 | Which columns the server table shows. | When you change the columns or the row density |
sd.density | Comfortable or compact table rows. | When you change the columns or the row density |
sd.compare.v1 | Your shortlist: the number, name, provider and page address of up to four servers. | When you add or remove a server |
sd.recent.v1 | The pages you looked at most recently (up to 12): title, short description and page address, plus a flag or logo where there is one. Shown under “Recent” in the search menu and under “Servers you looked at” on the compare page. | When you open a server page or pick a search result |
sd.filters.open.v1 | Which filter groups you opened or closed in the filter sidebar. | When you open or close a filter group |
sd_changelog_seen | The time of the newest changelog entry you have seen, so that newer entries are marked as new. | When you open the changelog |
These entries are written only when you use those controls or open a server page, and hold nothing about you beyond what the table lists. They are never sent to us automatically. The shortlist reaches our server only when you open the comparison page, as part of its address. You can remove them at any time by clearing this site’s data in your browser.
Clicks and usage counts
When you follow a “Visit” link, our server adds one to a daily total for that server and sends you on to the provider. The total records the day, the server and the provider, and nothing about you: no IP address, cookie, browser details or identifier. Browser prefetches and software that identifies itself as a bot are not counted. Your browser tells the provider only that you came from serverdiff.com, not which page. From then on, the provider’s privacy policy applies.
In the same way, once a list of servers or a comparison of two or more servers is on your screen, your browser asks our server to add one to a single daily total of list views or comparisons. The request carries only the name of the total. Nothing else about the visit is recorded.
Correction reports
When you report a correction, we store your message, your e-mail address if you choose to give one, which server the report is about, when it was sent and what an editor decided. We use the address only to ask about or answer your report, and we do not store your IP address with it. The basis is our legitimate interest in keeping the data accurate (Art. 6(1)(f) GDPR). Reports are kept for [retention, for example 12 months after the report is resolved].
If you write to [email protected], we keep the conversation for as long as it takes to deal with it, and no longer than [retention period]. Mail is handled by [e-mail provider].
Administrators
Accounts exist only for the people who maintain the data. For each of them we store an e-mail address, a name, a scrypt hash of the password, a role, an optional two-factor secret and the time of the last sign-in, and for each session its expiry and the browser’s user agent. Every change they make to the data is logged with who made it, when and why.
Hosting and service providers
The site runs on [hosting provider, company and country] in a data centre in [location]. Database backups are stored with [backup storage provider and location]. [CDN or reverse-proxy provider, if any.] We do not use analytics, advertising, error-tracking or font services, and we do not sell or share personal data. [State any transfer outside the EEA and its safeguard, or that there is none.]
Your rights
Under the GDPR you can ask for access to the personal data we hold about you, its correction or deletion, restriction of its use, and a copy in a portable format, and you can object to processing based on our legitimate interests. Because we hold almost nothing that identifies visitors, requests usually concern a correction report or an e-mail; tell us the address you used. We answer within one month. You can also complain to a data protection authority, in particular [competent supervisory authority] or the one where you live or work.
Changes and contact
When what we store changes, we update this page and the date at the top. Questions about privacy go to [email protected].